sinksmtp: correctly handle rules that match RCPT TO but defer to later

'@data reject to a@b' must be evaluated at RCPT TO time for each
RCPT TO value (unless I gorily change the semantics) but only take
effect at DATA (the same issue holds for @message). We now handle
this corner case correctly, or at least I hope.

This was a pain in the rear.

(I actually could change the semantics just in Decide(), by looking
for rules that require pRto and then running them once for each of
the accepted recipients. The rule would match if it matched for any
recipient. Hmm. That actually has better semantics than the current
setup; it is a bit weird that a @data time rule can match against a
rejected RCPT TO address.)
sinksmtp: switch to better handling for 'match RCPT TO, defer later' rules

This follows the scheme outlined in the aside in the previous commit.
At post-pRto time we evaluate any rule that requires pRto (or higher)
once for each (accepted) RCPT TO and take it if any of them match.
This simplies the code and throws out random bits and pieces.

As a side change, pData and pMessage now explicitly blank out
Context.rcptto's value, since it isn't well defined in general in those
phases (before, it was 'the last RCPT TO that was looked at').
This is not perfect, since checking a pRto rule with our special
hack will set Context.rcptto as a side effect and not clear it,
but it's better than nothing.
sinksmtp: improve parser error messages somewhat

They now don't include noise that they used to for some messages,
and the character/line position can be better.
Explicitly check that Next() accepts a HELO with no argument

ParseCmd() is tested earlier, but Next() adds another layer. Now I
explicitly check this, since I wound up wondering once.
sinksmtp: tune up the rules implementation some

- add 'dns exists'
- support 'helo-has bareip' by generating yes/no information about
  that in heloGetter().
- the address attribute 'noat' no longer implies 'unqualified'.
- deferred results from 'MAIL FROM:<>' now totally override later
  results, not just make them work. Ie, '@from stall all; @to reject
  all' now returns 4xxs on RCPT TO instead of 5xxs. This seems more
  correct.
sinksmtp: added a stab at real documentation for/about rules

This will eventually replace the comments at the start of cmd/rules.go
and scattered elsewhere.